While attempting to troubleshoot a cluster connection issue with Filebeat, I noticed this error references the /_xpack endpoint when it actually uses the /_license endpoint.
Apr 20 16:08:18 beat.host.name filebeat[5515]: 2020-04-20T16:08:18.309-0400 ERROR elasticsearch/elasticsearch.go:261 Error connecting to Elasticsearch at http://cluster.host.name:9200: Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /_xpack endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: could not retrieve the license information from the cluster: 429 Too Many Requests: {"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [3044232488/2.8gb], which is larger than the limit of [2978584985/2.7gb], real usage: [3044232488/2.8gb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b, accounting=0/0b]","bytes_wanted":3044232488,"bytes_limit":2978584985,"durability":"TRANSIENT"}],"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [3044232488/2.8gb], which is larger than the limit of [2978584985/2.7gb], real usage: [3044232488/2.8gb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b, accounting=0/0b]","bytes_wanted":3044232488,"bytes_limit":2978584985,"durability":"TRANSIENT"},"status":429}
The error caused some initial confusion since A) there is an error, and B) /_xpack is no longer used. It'd be best if the endpoint were not hardcoded in the error-- I'll leave that up to you. Can it at least not reference /_xpack?
indices.breaker.total.limitset too low in the cluster.While attempting to troubleshoot a cluster connection issue with Filebeat, I noticed this error references the
/_xpackendpoint when it actually uses the/_licenseendpoint.The error caused some initial confusion since A) there is an error, and B) /_xpack is no longer used. It'd be best if the endpoint were not hardcoded in the error-- I'll leave that up to you. Can it at least not reference
/_xpack?See also #15090.